Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 7260042b authored by Lee Nipper's avatar Lee Nipper Committed by Herbert Xu
Browse files

crypto: talitos - fix bug in sg_copy_end_to_buffer 



In function sg_copy_end_to_buffer, too much data
is copied when a segment in the scatterlist
has .length greater than the requested copy length.

This patch adds the limit checks to fix this bug of over copying,
which affected only the ahash algorithms.

Signed-off-by: default avatarLee Nipper <lee.nipper@gmail.com>
Acked-by: default avatarKim Phillips <kim.phillips@freescale.com>
Signed-off-by: default avatarHerbert Xu <herbert@gondor.apana.org.au>
parent 2716fbf6

drivers/crypto/talitos.c

+5 −1
Original line number Diff line number Diff line
@@ -1183,10 +1183,14 @@ static size_t sg_copy_end_to_buffer(struct scatterlist *sgl, unsigned int nents, 
				/* Copy part of this segment */

				ignore = skip - offset;

				len = miter.length - ignore;

				if (boffset + len > buflen)

					len = buflen - boffset;

				memcpy(buf + boffset, miter.addr + ignore, len);

			} else {

				/* Copy all of this segment */

				/* Copy all of this segment (up to buflen) */

				len = miter.length;

				if (boffset + len > buflen)

					len = buflen - boffset;

				memcpy(buf + boffset, miter.addr, len);

			}

			boffset += len;